Fix #224: Remove Potential Malicious Link in Parso's Acknowledgement README.rst

[nilbest]

Description

This pull request addresses issue #224 by removing the potentially malicious link from the Acknowledgements section of the README.rst. The link in question was flagged by internal IT as suspicious and has been excluded to ensure the safety and integrity of the parso package.

Additional Research:

• I'm not a security specialist, but a quick who.is search on the domain provided limited information.
  
  
  

Changes Made:

• Removed the following link from the README.rst:
  Salome Schneider https://www.crepes-schnaegg.ch/cr%C3%AApes-schn%C3%A4gg/kunst-f%C3%BCrs-cr%C3%AApes-mobil/

Verification:

Since it appears that the METADATA file may be generated from the README.rst during the installation process, it is expected that the link will no longer appear in the METADATA file after installing the updated version of parso. To verify this, please install the updated package in a virtual environment and confirm that the METADATA file does not contain the removed link.

Additional Notes:

• The link was removed from the README.rst with the expectation that it will not be present in the generated METADATA file.
• If there are any concerns or if further validation is needed, please let me know.

Reviewers:

@davidhalter - Could you please review these changes?

Thank you for your attention to this matter.

[davidhalter]

Thanks, that makes sense!

[davidhalter]

Because I'm interested: What tools did you use to find this? Was this something internal? What was the company? Feel free to write here or email me whatever information you're allowed to share.

[nilbest]

Sadly I could not tell you what program they used. I’m only a working student in the development apartment. I want to try Jupyternotebook in vscode to check some data from an embedded device  recorded on a self programmed stm32. I was quite shocked and confused about the call they gave me 1h after installing the IPython Kernel. I hope it does not escalate internally. It triggered some kind of it security system that checks our one-drive accounts. Maybe if they call me again I can try to ask for the program, but I think it could be some kind of one drive flow that searches each file for suspicious links. It deleted the file automatically. At home, I wanted to check this problem out by myself to see what it was. That's why I ended up here with the issue. Hopefully, it will fix that problem in the future and the next time I create a new venv I do not get the same call again. I do not feel free to share the company name, hopefully, you understand that. Best regards from Germany Nils Bestehorn

[nilbest]

Also, do you know if we fixed this now in the main branch, would it automatically be included in the newer version of this repo?

I only installed ipykernel and got this repo in version 0.8.4 with the bad link.
(Followed this guide:
https://docs.jupyter.org/en/latest/install/kernels.html
And got to this install instructions:
https://ipython.readthedocs.io/en/latest/install/kernel_install.html)

I looked into ipykernel dependency but they do not mention this repo so it may be included in one of the other mentioned repos in ipykernel.
Link to the ipykernel pyproject.toml for dependencies:
https://github.com/ipython/ipykernel/blob/main/pyproject.toml

Maybe you know more about where this repo may be included and if so would it be the last updated version without this link, so that the security wouldn't trigger again…
If not I may have to dig a bit more to get to the install call of this repo to fix this…

(if I get the time in the next few days)

[davidhalter]

Hi Niels

This will probably keep happening if you use the currently released parso. Your change is now on master branch, but not released on PyPI. If you want to use the version with the fix, you can install parso like this: https://parso.readthedocs.io/en/latest/docs/installation.html#from-git. If you use it with Jupyter you can probably just install parso first and then the rest.